Comment by wallflower | Hacker News Reader

Comment by wallflower | Hacker News Reader

> Taken individually, most of these services have reasonable security precautions against intrusion. But there are huge weaknesses when they are looked at together, as an ecosystem. Like dominoes, once one fell (Gmail was the first to go), the others all tumbled as well.

Like many others, I gradually gave up my internal resistance on Google knowing most everything about me and have adopted Gmail as my primary mailbox.

1) Enable SSL by default on Gmail

https://mail.google.com/mail/#settings

Scroll down to bottom and choose 'Always use HTTPS' for 'Browser Connection'. Click 'Save settings'

2) Change your Gmail security question (you may want to do this now because you may have forgotten the answer to your own question that you set way back when you registered)

http://mail.google.com/support/bin/answer.py?hl=en&answe...

3) If you can't answer your Gmail security question, it will send a password reset email to your secondary email address. Consider the risks of having the secondary email address compromised (and decide whether to remove it or change it to one with a secure 'secret question' process - e.g. if you work for a company, your work email)

http://mail.google.com/support/bin/answer.py?hl=en&answe...

In addition to what you listed, I think the article's point about one's password being findable in their mailfile is a great catch.

In order to be aware that someone has compromised your mail, it's essential that they not be able to reset your password to its old value. Therefore, your password for e-mail should never be findable in your mailfile, nor should it be the same password you use for any other web service. Because you never know what stupid web service will send your password to you in cleartext upon request.

Of course, it's not a good idea to share passwords among different services in general, but keeping your mail password separate is particularly important.

Mail and commerce. Those require separate and unique and crazily difficult to guess passwords. The problem is too many people just can't bother with the perceived hassle

I deliberately set up a secondary email address that I use for nothing else and has a unique but memorable password.

Then I just mashed the keys for the security question.

It's a pity that google docs doesn't have that SSL option

Google will have to eventually respond (with action) to that and more security concerns outlined in this June 2009 open letter to the Google CEO demanding 'security by default' from 38 leading security researchers including Bruce Schneier and Ron Rivest.

http://files.cloudprivacy.net/google-letter-final.pdf

They did respond. Kind of.

http://googleonlinesecurity.blogspot.com/2009/06/https-secur...

but the original attack wouldn't have changed one bit with SSL. Peter Guttman wrote a great paper on how we defend where the attackers aren't attacking. SSL in this case would have been one such example. Of course, SSL has value in other cases (sniffing, ensuring you're talking to the right site, etc) but is no panacea.

It does for me, the link to Google Docs from my Gmail is HTTPS. Same for Calendar and Sites. Going directly to docs.google.com redirects me to the secure version--I think it works off the SSL by default setting in Gmail.

Reply on news.ycombinator.com